badmirror | 855fb4a09c7e6c64fba528227f8e4c1d_JaffaCakes118

General

Target

855fb4a09c7e6c64fba528227f8e4c1d_JaffaCakes118
Size

15.1MB
MD5

855fb4a09c7e6c64fba528227f8e4c1d
SHA1

c9670d7d47e6c64c46d83c38f7b0c9b5803aa3d0
SHA256

b42b2e77480dda65adb18e4eef8050db1f68ca256f28b4a0acaa9fe7d3455dbd
SHA512

e95071351872d6a6d400a96e04f1ebaea7e05122b3073367dcd5e913938b433667147acc2397822f6a5efab60f9bea4159321a427d2d9913748cfb4179d74d2e
SSDEEP

393216:zSTQrJtD4D0f/Lqrxq4o/EMYaTLRn31WpUEBO:9k8/W4p/EMZLRx

Score

10^/10

badmirror

Malware Config

Signatures

BadMirror payload 1 IoCs

resource	yara_rule
sample	family_badmirror

Badmirror family
badmirror

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Files

855fb4a09c7e6c64fba528227f8e4c1d_JaffaCakes118
.apk android arch:arm

com.game.cqzjh.zhexin

com.boyiu.xpzjh.YSZ

Activities

com.boyiu.xpzjh.YSZ

android.intent.action.MAIN

com.excelliance.open.NextChapter

com.excelliance.open.action.startNextChapter

com.excelliance.open.PromptActivity

com.excelliance.open.action.startPromptActivity

Permissions

android.permission.INTERNET
android.permission.READ_PHONE_STATE
android.permission.WRITE_SETTINGS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_COARSE_LOCATION
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.GET_TASKS
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.GET_DETAILED_TASKS
android.permission.REORDER_TASKS
android.permission.INTERNET
android.permission.WAKE_LOCK
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.GET_TASKS
android.permission.READ_PHONE_STATE
android.permission.WAKE_LOCK
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_PHONE_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.READ_LOGS
android.permission.VIBRATE
android.permission.CAMERA
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_PHONE_STATE
android.permission.INTERNET

Receivers

com.excelliance.lbsdk.base.BGReceiver

android.net.conn.CONNECTIVITY_CHANGE
com.excelliance.open.action.appstate
com.excelliance.open.action.queryUpdate
com.excelliance.open.action.ss
android.intent.action.MEDIA_MOUNTED

Services

com.excelliance.lbsdk.debug.LBSdkCrashReportService

com.excelliance.lbsdk.debug.action.CRASH_REPORT
com.excelliance.kxqp.platform.action.CRASH_REPORT

com.excelliance.lbsdk.base.BaseService

com.excelliance.lbsdk.action.BaseService

com.excelliance.lbsdk.main.BGService

com.excelliance.open.action.gameverchk
com.excelliance.open.action.apkverchk
com.excelliance.open.action.dmchk
com.excelliance.open.action.fw
com.excelliance.open.action.bwbxdla
com.excelliance.open.NEXT_CHAPTER
com.excelliance.open.action.PLAT_DO
com.excelliance.lbsdk.action.BGService

Android Permissions

855fb4a09c7e6c64fba528227f8e4c1d_JaffaCakes118

Permissions

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.WRITE_SETTINGS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.CHANGE_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.GET_TASKS

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.GET_DETAILED_TASKS

android.permission.REORDER_TASKS

android.permission.INTERNET

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.GET_TASKS

android.permission.READ_PHONE_STATE

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_PHONE_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_LOGS

android.permission.VIBRATE

android.permission.CAMERA

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.INTERNET

Sharing

General

Malware Config

Signatures

Files

com.game.cqzjh.zhexin

com.boyiu.xpzjh.YSZ

Activities

com.boyiu.xpzjh.YSZ

com.excelliance.open.NextChapter

com.excelliance.open.PromptActivity

Permissions

Receivers

com.excelliance.lbsdk.base.BGReceiver

Services

com.excelliance.lbsdk.debug.LBSdkCrashReportService

com.excelliance.lbsdk.base.BaseService

com.excelliance.lbsdk.main.BGService

Android Permissions

855fb4a09c7e6c64fba528227f8e4c1d_JaffaCakes118